OpenWrt in Industrial Routers: Who Uses It

What OpenWrt is, in two minutes

OpenWrt began in 2004. Linksys had built the firmware for its WRT54G home router from GPL licensed code, so it had to release its modified source, and independent developers used that source to create their own router distribution. Twenty years on, OpenWrt is a full Linux distribution for embedded networking devices, with a package system, a web interface called LuCI, and support for hundreds of chipsets.

The project split in May 2016, when core developers forked it as LEDE over disagreements about process. The two sides agreed to remerge, announced it formally in January 2018, and completed the merge before OpenWrt 18.06. Every release since has been under the OpenWrt name.

As of October 2026 the current stable series is OpenWrt 25.12, released in March 2026. It is also the release that replaced the long-standing opkg package manager with apk. According to the endoflife.date tracker, the previous 24.10 series reached the end of its security support on 30 September 2026, so 25.12 is the only OpenWrt series currently receiving fixes.

Each major series gets security fixes until roughly six months after its successor ships, with at least a year from its own release. That is short compared with the eight to fifteen years an industrial router stays in a cabinet, and it is the single most important thing to understand about OpenWrt based products.

Why industrial router makers build on OpenWrt

The appeal is obvious. OpenWrt gives a hardware maker a mature, widely reviewed networking stack: routing, firewalling, VPNs, VLANs, wireless and a package ecosystem, already ported to the chipsets they buy. Chipset vendors reinforce it; Qualcomm's QSDK, the software kit that ships with many of its networking chips, is itself an OpenWrt derivative. A small engineering team can put its effort into the parts customers actually see, such as industrial protocols, cellular failover and cloud management, instead of rewriting a router from scratch.

The cost is that the vendor inherits OpenWrt's release cycle. Once a product ships on, say, 21.02, the vendor either rebases onto newer OpenWrt releases, which is real work, or backports security fixes into its own fork. Either is fine if done consistently. Neither is visible from the outside unless the vendor tells you or you look.

The other routes

Not every maker chooses OpenWrt. The main alternatives in industrial IoT are:

• Debian based systems, such as Robustel's RobustOS Pro. A general purpose distribution with long support windows and familiar tooling, well suited to edge gateways that run customer applications.
• Yocto or OpenEmbedded builds, such as MultiTech's mLinux for its Conduit gateways. The vendor assembles its own distribution from recipes, with full control over every package.
• Vendor Linux, such as Digi Accelerated Linux, Advantech's ICR-OS and INSYS icom OS. Linux underneath, but the vendor does not describe it as a derivative of a public distribution.
• Proprietary systems, such as Cisco IOS XE, MikroTik RouterOS (MikroTik's own OS on a Linux kernel) and Sierra Wireless ALEOS. Closed, often with long enterprise support processes.

There is no winner. OpenWrt based firmware can be excellent and a proprietary system can be neglected. What matters is whether the vendor is open about the base, how it keeps that base patched and how long it commits to doing so.

The big list: what industrial IoT routers and gateways run

The list covers 35 manufacturers across three segments: IoT router specialists, enterprise and carrier brands, and industrial automation makers. Each row is based on the manufacturer's own documentation, product pages or source code releases. Where a vendor does not say what its firmware is built on, we say so rather than guess. "Not disclosed" is not a criticism; it means you need to ask.

"Not found" means we could not find a published source code offer on the manufacturer's site in October 2026; it may exist on request. "Not checked" means we did not look. If you are a manufacturer and a row is wrong or incomplete, send us the documentation and we will update it.

Big brands and specialist industrial routers: a different model

The pattern changes as you move away from the IoT specialists. The enterprise and carrier brands, Ericsson Cradlepoint, Cisco, Fortinet, Huawei, Digi and Inseego among them, sell the router as one part of a managed network or security service. Cradlepoint pairs its routers with NetCloud Manager and NetCloud Exchange, and its rugged IBR1700 data sheet lists an SDK, an API and container support. Fortinet's FortiExtender is managed from a FortiGate firewall. Cisco's Catalyst IR1101 runs IOS XE and is managed through Field Network Director or Catalyst SD-WAN Manager. For these buyers the software question is about the vendor's whole platform, its subscription terms and its security process, rather than a Linux distribution.

The industrial automation makers sit inside larger automation ecosystems. Siemens launched the SCALANCE MUM856-1 in June 2021 as its first industrial 5G router, with an IP65 housing, fallback to 4G and support for private 5G networks, and manages it through SINEMA Remote Connect. Phoenix Contact's TC ROUTER family now includes the 5004T-5G with four Gigabit Ethernet ports, managed through TC Router Online Manager, which can run on premises or in a cloud. HMS Networks ties its Ewon remote access routers to the Talk2M service. Belden's Hirschmann OWL routers are described as an open Linux based platform. None of these makers names the operating system underneath on the product pages we checked.

That is not a red flag in itself; automation buyers often care more about the PLC integration and VPN platform than the kernel. But it does mean the GPL and version questions in the next section apply to them just as much as to a budget gateway.

Your GPL rights, and why they are a buying tool

The Linux kernel is licensed under the GNU General Public License version 2, and much of an OpenWrt system is GPL or LGPL code. A manufacturer that ships those binaries inside a router has to make the corresponding source code available to the people it distributes them to. Teltonika does this through an open source page with SDK packages for each router family, citing the GPL, LGPL, Apache and MIT licences. Advantech says ICR-OS is built on software released under licences including the GNU GPL v2 and v3 and links to its source code page. MultiTech publishes mLinux in a public git repository.

For a buyer, this is a free and lawful due diligence step. Asking for the GPL source of the exact firmware version you are buying tells you three things: whether the vendor really controls its software, which OpenWrt or kernel release it is built on, and whether it takes licence obligations seriously. A vendor that cannot answer is telling you something too. We cover the wider supplier checks in our guide to industrial router provenance.

Base versus vendor: where security actually comes from

An OpenWrt base does not make a router secure or insecure on its own. The vendor's own code, the web interface, the cloud agent, the defaults and the patch process matter at least as much.

Four-Faith shows why. In December 2024 VulnCheck reported in-the-wild exploitation of CVE-2024-12856 against Four-Faith F3x24 and F3x36 industrial routers: an OS command injection in the router's own web interface, reachable without valid credentials on devices left with their default login. Around 15,000 of them were visible on the internet. Nothing about that flaw depended on which Linux was underneath. It came from vendor code and deployment hygiene, which our cellular router security hardening guide covers brand by brand.

Where the base does matter is in the long tail. A router built on an OpenWrt series that has left security support depends entirely on its vendor to carry fixes forward. With 24.10 support ending in September 2026, any OpenWrt based industrial firmware still on 24.10 or older is now in that position, and buyers should ask how the vendor handles it.

How to find out what your router runs

If you have shell access to a router, three commands usually answer the question in seconds. On an OpenWrt based device, the release file names the OpenWrt version and target:

cat /etc/openwrt_release

On most Linux based systems, this identifies the distribution and version:

cat /etc/os-release

And this shows the Linux kernel version, which you can compare against the kernel's own long term support list:

uname -a

Without shell access, check the firmware release notes, the vendor's open source or GPL page, and the licence notices inside the web interface, which often list every open source package and version. A web interface that looks like LuCI is a strong hint, but treat it as a hint, not proof; vendors frequently restyle it beyond recognition.

Frequently asked questions

Related reading